Returnil

Discussion in 'sandboxing & virtualization' started by biatche, May 14, 2007.

Thread Status:
Not open for further replies.
  1. Coldmoon

    Coldmoon Returnil Moderator

    Joined:
    Sep 18, 2006
    Posts:
    2,981
    Location:
    USA
    Hi hojtsy,
    Is this system setup for multi-OS booting? IOW, do you have an OS installed on C:\ and another on F:\? From the designations, it appears that F:\ is set up as the System Partition...

    It may also help to understand what your system configuration is designed to do. Of interest is the purpose behind the two HDD types - especially the SATA drive connected to your PCI card.

    Thanks
    Mike
     
  2. Tony

    Tony Registered Member

    Joined:
    Feb 9, 2003
    Posts:
    725
    Location:
    Cumbria, England
    One thing i have noticed on your website for the information for Returnil Virtual System Personal Edition
    If i click on the majorgeeks link from this page http://www.returnilvirtualsystem.com/index_files/rvspersonal.htm to download Returnil, then the page it takes me to is the Business Edition 1.62.4105 for download.

    The other link "free download" correctly takes me to the Personal Edition 1.6.2.4107.
     
  3. Coldmoon

    Coldmoon Returnil Moderator

    Joined:
    Sep 18, 2006
    Posts:
    2,981
    Location:
    USA
    Hi Tony,
    Thanks for the heads up - I will let the team know about this link error and get it fixed ASAP

    Mike
     
  4. Tony

    Tony Registered Member

    Joined:
    Feb 9, 2003
    Posts:
    725
    Location:
    Cumbria, England
    Hi Mike, no need to thank me.
    Its me who should be thanking you for letting me have this superb software for free along with the first class support that you also provide for free.:thumb:
     
  5. hojtsy

    hojtsy Registered Member

    Joined:
    Dec 28, 2003
    Posts:
    351
    I accidentally created a multi-boot configuration some time ago, when I purchased the new SATA drive. I attempted to install a standalone windows to the SATA hard drive and set BIOS to boot from that drive. But I made an error of keeping the old PATA drive connected while installing windows to the other drive. This error resulted in some crippled windows installation on the SATA drive which could not boot the SATA drive withouth the PATA drive present. This was not what I wanted, so disconnected the PATA drive, and installed windows on the SATA drive again. Installation was OK, but booting was only possible if the install CD was in the drive. I suppose that the SATA card caused the problem during booting. I gave up an reformatted the SATA drive, to make it a data-only partition. I restored the system partition of the PATA drive from backup image.
    I believed that I removed all traces of a previous multi-boot config as I
    - reformatted SATA drive (F:)
    - restored PATA drive primary partition C: to a previous state
    - reset the BIOS setting to boot from the PATA drive
    Where else can traces of a previous multi-boot config hide? Maybe in the First Track?
     
  6. Long View

    Long View Registered Member

    Joined:
    Apr 30, 2004
    Posts:
    2,295
    Location:
    Cromwell Country
    Is there anyway to turn off the annoying bubble "System Protection is Currently ON" ? at start up. The Red tray icon is enough for me.
     
  7. Franklin

    Franklin Registered Member

    Joined:
    May 12, 2005
    Posts:
    2,517
    Location:
    West Aussie
    System Protection on or off prompt at startup.Yep, be nice to be able to turn it off from the gui.
     
  8. hojtsy

    hojtsy Registered Member

    Joined:
    Dec 28, 2003
    Posts:
    351
    Coldmoon,
    If I understand correctly Returnil protects \Device\HarddiskVolume1 even if that is not the system partition. Returnil should instead read the
    HKLM\System\Setup\SystemPartition value from the registry and protect that volume as system.
     
  9. Osaban

    Osaban Registered Member

    Joined:
    Apr 11, 2005
    Posts:
    5,616
    Location:
    Milan and Seoul
    I must say that this program seems to have a lot of potential, I've downloaded it and so far it's been even lighter (only a feeling) than ShadowUser (this is my default virtual program).

    I also want to add that I'd like to try Returnil within ShadowUser, and viceversa ShadowUser within Returnil. Before I might be heading to an ATI emergency restoration, can anyone predict an outcome or has anybody tried something similar. I know that would probably be overkill to run them together, but they definitely work in different ways.

    Also reading this thread somebody mentioned that ShadowUser wouldn't survive the Killdisk trojan.... Any thoughts?
     
  10. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    I've tested both Shadowuser and Returnil against Killdisk. Returnil now survives it nicely. Shadowuser fails, you lose the disk without ATI. In fact before you can recover with ATI, you have to have some means to delete the partition. I tested with version 9 of ATI since I own that version, and it didn't even see the disk after the killdisk attack.

    Pete
     
  11. Osaban

    Osaban Registered Member

    Joined:
    Apr 11, 2005
    Posts:
    5,616
    Location:
    Milan and Seoul
    Thanks for your reply, what would you say about running ShadowUser within Returnil? I know I should do my own tests and bear the consequences, but I'm not so computer savvy like some of you guys.

    When you say"some means to delete the partition" is that a program, and which one if I may ask?
     
  12. Old Monk

    Old Monk Registered Member

    Joined:
    Feb 8, 2005
    Posts:
    633
    Location:
    Sheffield, UK
     
  13. Osaban

    Osaban Registered Member

    Joined:
    Apr 11, 2005
    Posts:
    5,616
    Location:
    Milan and Seoul
    I'm not giving up ShadowUser yet, but i've been struck by Peter2150 tests with this killdisk trojan, and the possibility of not being able to recover with ATI (I believe this is all we are interested in after all, to save our precious info).

    ShadowUser offers more options than Returnil, at a price of course, but I was wondering if combining the two one could get that certainty of removing that remote but possible threat.
     
  14. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Hi Osaban


    If you are not up to bearing the consequences, and it very wise knowing ones limits, I would strongly suggest not running them together. Hard to say what might happen. Besides I agree with old monk. What's the point.

    As far as deleting the partition, there are several tools that can do this, but my advice, is don't mess with this stuff, as you can easily get in over your head. I know.

    Pete
     
  15. Coldmoon

    Coldmoon Returnil Moderator

    Joined:
    Sep 18, 2006
    Posts:
    2,981
    Location:
    USA
    Hi Osaban,
    I agree with Peter on this, there is really little to gain for too much potential risk. If you are looking for a more restrictive setup, you could start by trying SandboxIE within Returnil as both play nicely together...

    Mike
     
  16. Osaban

    Osaban Registered Member

    Joined:
    Apr 11, 2005
    Posts:
    5,616
    Location:
    Milan and Seoul
    @ Peter2150

    I couldn't agree more, thanks for the advice, and if I remember correctly you said that most good AVs would stop something like killdisk.

    @ Coldmoon

    I wish your company a great future, I uninstalled Returnil from my machine and installed it into my son's computer where it's working fine.

    If Returnil's future upgrades will compete with the current version of ShadowUser, I might consider changing (money is not an issue). I'm happy with ShadowUser but Storagecraft seems only concerned in developing ShadowProtect. They haven't done a single thing to ShadowUser in almost two years (and there are issues).

    Thank you for your great support.
     
  17. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Hi Osaban

    Yes, several AV's I tried stopped Killdisk. Also Returnil protects track 0 and the mbr, so it also protects you.

    Pete
     
  18. kennyboy

    kennyboy Registered Member

    Joined:
    Oct 4, 2006
    Posts:
    431
    Just wondering what sort of surfing or downloading you would be doing that would need BOTH Sandboxie and Returnil together. I use both selectively, but not sure where I am still vulnerable if only running one.

    Would NOD32 be one of those you tried by any chance. Nod won't let ANYTHING through my system......even when I want it to.................lol
     
  19. Franklin

    Franklin Registered Member

    Joined:
    May 12, 2005
    Posts:
    2,517
    Location:
    West Aussie
    With just Returnil running you can still get infected which will require a reboot to be rid of.

    With Sandboxie running as well any inet borne attacks are contained so all you have to do is empty the sandboxie to kill off any infections instead of a reboot.

    Been running both here with no probs or slowdowns.

    Sandboxie was and always will be my first line of defense here.;)
     
  20. innerpeace

    innerpeace Registered Member

    Joined:
    Jan 15, 2007
    Posts:
    2,121
    Location:
    Mountaineer Country
    I run both just because I have my default browser set to run sandboxed. It's just another layer of protection for me. Sandboxie isolates my browser or whatever I run sandboxed from my system and Returnil RVS isolates my system partition from my system.
     
  21. kennyboy

    kennyboy Registered Member

    Joined:
    Oct 4, 2006
    Posts:
    431
    @ Franklin and Innerpeace.

    Thankyou for your input. I did try and run my browser (Opera) with Returnil, but found the issue of not being easily able to save Bookmarks etc a pain. (I dont use a VM) I have yet to find a way of changing the default Opera bookmarks/adresses folder to another partition, so it is an issue that I need to solve if I am to use Returnil to its fullest potential. I do like the program very much though.
     
  22. innerpeace

    innerpeace Registered Member

    Joined:
    Jan 15, 2007
    Posts:
    2,121
    Location:
    Mountaineer Country
    Are you saying that you don't have the Virtual Partition installed with RVS? If you do have a VP, a simple but primitive way to save your bookmarks would be to create a notepad file and then copy and paste the bookmark addresses to the file and save it to the VP. Then later when your not using RVS protection, you can add the bookmarks manually from the VP to Opera. It's my 'caveman' workaround. No offense to any cavemen :p .

    I'm also having trouble grasping the whole 'save your data to another partition' thing. That is why I have a small (2GB) virtual partition. It's my 'buffer zone' in learning about separating my data from my programs.

    Hopefully someone will give you better and more specific help for your specific problem.
     
  23. kennyboy

    kennyboy Registered Member

    Joined:
    Oct 4, 2006
    Posts:
    431

    Your "Caveman" approach is the only way I can think of doing it, but its a bit too fiddly for me, but appreciate the thought.

    For me, it's just a question of safeguading my Data. I know that when it is on a seperate partition, a) it is safe from outside pollution, (and Operating System Glitches) and b) it makes backup a little bit easier and quicker. Just something I have always done.
     
  24. Huupi

    Huupi Registered Member

    Joined:
    Sep 2, 2006
    Posts:
    2,024
    You Guys are so puzzled with VP,at setup you have a choice to create VP or not,i choose not to create one.if i am in Returnil session,data that has to stay i copy to ext. drive,after reboot i bring real system current with my backed up data on the ext. drive,no hassle with VP and if disaster strikes your system or your int.disk toasted,then your safe with this strategy.
     
  25. dartsmaster

    dartsmaster Registered Member

    Joined:
    Jan 16, 2005
    Posts:
    5
    Location:
    England
    I have a basic two hard disk setup with C - Q partitions on the first disk and R - U partitions on the second disk. Windows XP is on the C partition & the DVD-ROM is drive D. I installed Returnil on the E partition and activated Session Lock to protect the C partition. I added some files to the C partition whilst in protected mode, and then rebooted. The files were still there :'(
    After some experimenting I have found that Returnil is only protecting the Q partition for some reason. Q only contains some program installation files. There has never been an operating system on anything other than the C partition, and the PC has never been dual boot.
    I have run Diskpart, and the C partition is listed as \Device\HarddiskVolume1 (as I think it should be) and the Q partition is listed as \Device\HarddiskVolume14.
    Any ideas? o_O
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.